Self-assessed does not mean unexamined

2026-09-16T00:00:00+10:00

There is a particular kind of relief that arrives when a space company works out that most of CMMC Level 2 is self-assessed. Nobody is coming. There is no assessment body to queue behind and no date in the calendar. Since Phase 1 opened on 10 November 2025 you post your own score in SPRS and affirm it, and the move to third party assessment was suspended in July 2026 with no replacement date set.

The relief is misplaced, and it is worth being precise about why — because the reason is not "they might still check".

What you are actually signing#

The affirmation is a legal instrument.

When you post a score you are making a representation, in writing, to a government, about the state of a system you control and they do not. The absence of an assessor does not make that representation softer. It makes you the only person who examined it.

Aerojet Rocketdyne paid $9M in 2022 to settle allegations it misrepresented its cybersecurity compliance. That matter did not turn on a failed audit. Nobody had audited them.

The asymmetry#

Here is the shape of the problem.

A score is a number, and producing one takes an afternoon if you are willing to be generous with yourself. The number looks identical either way: a score arrived at carefully and the same score arrived at optimistically are the same digits in SPRS.

What differs is what sits behind them — and that only ever gets examined at the worst possible moment. When a prime's security annex asks you to substantiate a control. When a customer's questionnaire asks a question the number does not answer. Or when somebody starts asking whether the representation was true.

The thing worth building, then, is not the score. It is the evidence.

What evidence actually means#

"Evidence" is a word compliance tooling has flattened into "a screenshot in a folder". What a prime, a regulator or a court would want is narrower and harder:

Which control, as the standard states it. Not as your tool paraphrases it. Level 2 is the 110 controls of NIST SP 800-171, and the wording carries the obligation.
What implements it in your environment. A configuration, a process, or a person with a name. "We have a policy" is not an implementation.
How you know it is still true. A control verified in March and not looked at since is a claim about March.
Where it does not apply, and why. This is the one most self-assessments skip, and it is the one that does the most work.

Scope is where a self-assessment quietly inflates#

The failure mode that matters most is not a company claiming a control it does not have. That is rare, and it is obvious when it happens.

It is a company answering for a system it does not operate.

A space company that flies nothing and runs a ground station has a genuinely different control set from one flying a constellation, and a smaller one. But generic tooling does not know that, so it asks every question, and the honest engineer filling it in starts inventing plausible answers about systems that do not exist. The score goes up. The evidence behind it goes to nothing.

Scoping by payload class, bus model and orbital layer is not an optimisation. It is the difference between a document you can defend and a document that falls apart on the first substantive question. Ground segment controls apply to the ground segment. You should not be answering for a constellation you do not fly.

What to do before someone asks#

Three things, in order, and none of them require an assessor.

First, write down your scope and the reason for it. If you cannot say in a paragraph which systems are in, which are out, and why, the score is not meaningful yet.

Second, for each control in that scope, name the thing that implements it and the date you last confirmed it. The gaps will become obvious, and that is the point.

Third, order the gaps by what closing them costs and by how much else depends on them. Everyone finds problems. The order to close them in is the useful part — which is why our findings arrive graded U1 to U5, cheapest and most load bearing first.

You sign the number. Make sure you would be comfortable showing what sits behind it.